@news: "Hi
I am looking for a router recommendation.
Simple requirements:
Support for ADLS2+
Needs to have inbuilt firewall (not just NAT).
Firewall must work when NAT is disabled.
1-port switch is OK (so is more ports).
Wireless not really wanted or required but would still be considered.
Would prefer a well-known brand with a good support site.
3-G fail-over would be very advantageous but not vital.
Has anyone any experience of these (not interested in Billion, see
below)
I have a Billion Bipac 7402X but the *firewall* in this does not work if
NAT is disabled (all incoming and outgoing data is completely
unrestricted).
Does the ZyXEL P660H-61 support ADSL2+ and if so what is the ADSL2+
performance like?
I have one of these but it has had a few issues lately. If it supports
and works well with ADSL2+ I will hang on to it as a backup.
Many thanks
PAJ"
    @discountfitnessequipment: "<quote>
<url>
That's what I have.
Dual WAN port, Wan 2 can be used as 3G Fail over. USB port on the router
can go into a USB hub and I believe it can run as an FTP
server-on-a-stick, Printer server and 3G connection at the same time.
I only use my USB port for network print server.
It's also got an extremely versatile and very functional dual ATA voip
port. I actually have 2 linking home with shop via inbuilt VPN
client/servers
Excellent support from the company and  some  fantastic products one of
which should suit your needs.
HTH
Pete"
    @discountfitnessequipment: "<quote>
Sorry, Forgot to say.... Doesn't have an inbuilt modem but supports
ADSL2+ very nicely. I have the shop one on a Be* Pro connection ADSL2+
AnnexM (getting 22Mbps/2.2Mbps)with failover on WAN2 on a PAYG Entanet
ADSL.  And one at home on an O2 ADSL2+ connection using both ISP
supplied boxes set up as transparrent bridges so connection speeds are
as hot as  using the Be* box as the modem/router/switch by it's self.
Likewise it also means it is just as at home sitting on a cable modem.
The Vigour100 modems I used prior to the O2/Be boxes couldn't quite cut
it on ADSL2+ only  giving me  around 85% of the speed of the Thomson
Speedtouch boxes. So they are now in a cupboard in case of Modem failure.
VOIP works brilliantly for squeezing 2 lines out of your ADSL line and
you can have up to 6 different VOIP  accounts set up too. Great for
different incoming numbers and preferred outgoing call routing.
Ummm do you get the feeling I really like 'em?
:�)
Pete"
    @news: "On Tue, 20 Jan 2009 20:36:57 +0000, "<url>
<quote>
Thanks for this. I had actually just started looking at the Vigors,
specifically the 2820 (it looks really good.). I had looked at the 2910
but for some reason I thought it did not support ADSL2+ (maybe I will
revisit this).
I just joined their forum to get some opinions on the 2820.
I have also emailed Draytek (SEG Communications) and asked if they could
confirm if the firewall works fully when NAT is not used. Not sure if
they will reply as the form said it was not to be used for pre-sales
(but I cannot find any other way to contact them).
I have no need for the VoIP (have this taken care of already) or
wireless so the 2820 should suit me perfectly (and save a few bob).
I think I may become a fan too if the firewall works properly with no
NAT.
Thanks again."
    @sardines: "<quote>
I am looking at the 2820.  With adsl2+ apparently coming end of March and 
we have 802.11n in the Maclaptops, it seems to be ideal on paper.
Currently, I have a Vigor 2600W and the firwall certainly works on that, 
having had to kill an ongoing ddos reflection attack problem. My only 
slight worry on this is the terminology they use, namely "ignore" rather 
than "drop".  I hope it is dropping rather than rejecting.
Alan
( If replying by mail, please note that all "sardines" are canned.
   However, unless this a very old message, a "tuna" will swim right
   through. )"
    @whatmeworry: "Do any of these recommended routers support NAT loopback? That is, if I have 
group 1 of my LAN nodes mapped by NAT to WAN address A, and group 2 of my LAN 
nodes mapped by NAT to WAN address B, can I connect to externally accessible 
servers in group 1 from nodes in group 2 by connecting to WAN address A (i.e. 
not by connecting to the server's LAN address)?
NAT loopback used to work well (once enabled) on the Zyxel P-660HW-61, but on 
the newer P-660HW-D1 it only works between nodes mapped to the same WAN 
address, i.e. in the example above, I can connect to servers in group 1 from 
other nodes in group 1 (using WAN address A), but if I try connecting from 
group 2 I get a partial connection in which the server is unable to send the 
connection reply."
    @08458686888: "<quote>
Draytek do VLAN but I think that's more down to ethernet ports etc.
<url>
This also incorporates (on mine) WVLAN so wireless 15 wireless groups
can be connected to or restricted from any combinations of the 4 VLAN's
on ethernet ports.
Not quite what you're after though I don't think.
<url> - Fitness+Gym Equipment.
<url>
<url>
<url>"
    @whatmeworry: "<quote>
No, not really what I'm looking for. What I want to do is set up a server for 
access from the outside world - say an FTP server on ftp.mydomain.co.uk - and 
test it by connecting to ftp.mydomain.co.uk with an FTP client on a different 
PC on the LAN (or even the same PC, but using a different IP address which maps 
via a different NAT group). Connecting by LAN address does not test the setup 
properly, since the FTP server is set up to tell the remote PC to set up a data 
connection on the WAN address.
Basically, I want one of my PCs to be able to connect to another exactly as if 
they were remote from each other, like another user connecting from outside."
    @invalid: "only.invalid says...
<quote>
Tests done by AAISP show the -61 will work with 21CN ADSL2+ but it 
synchronises at a lower speed than other models, and that is variable. 
They are setting 21CN conversions on lines with a -61 to 20CN speeds. 
The -D1 is OK AFAICR
John W
To mail me replace the obvious with co.uk twice"
    @news: "On Wed, 21 Jan 2009 14:56:06 -0000, John Weston
<quote>
OK thanks. I guess I will hang on to it as a spare (until I find a
better one)."
    @news: "On Wed, 21 Jan 2009 00:08:36 +0000, Alan Clifford
<quote>
This is what I thought. I am going to ask broadbandbuyer to accept a
return of the Billion Bipac 7402X (as it is not fit for purpose) as a
part exchange towards the 2820.
If not I will have to put the 7402X on ebay and accept a small loss.
Good news, thanks. I have had one reply on the Vigor forum that states
the firewall works without NAT.
Thanks :)"
    @a: "<quote>
Well I have set up many such networks. I just arrange a friend to test 
for me,after I have it working internally.
You are unlikely to get a couple of WAN addresses anyway..."
    @whatmeworry: "<quote>
What if I'm experimenting with a lot of configurations, or I want to test a lot 
of different modes of access? I'm not sure I've got friends with that much 
patience. Not for long, anyway.
Get yourself a decent ISP (see cross-posting of this thread). I have a bank of 
16 WAN addresses, no extra charge."
    @a: "<quote>
Get a shell login  on a friendly external site...
<shrug>
No need for all that, since I can host as many sites as I want on one..."
    @whatmeworry: "<quote>
There's always someone who insists on answering a different question from the 
one asked ... :)
Fine, if that's all you need. What if you wanted to host two web servers, both 
on port 80, or two mail servers, both on port 25? You might want to experiment 
with the configuration of one while keeping the other running.
Anyway, back to the original question ... does anyone have a recommendation for 
a router that does NAT loopback properly?"
    @a: "<quote>
Got five on the one address as I write.
  or two mail servers, both on port 25?
I'd use sendmail to put both on one, and split teh mail from there.
You
Very few do that."
    @whatmeworry: "<quote>
Presumably that's five domains served by one server, not five separate servers.
Missing the point again ... I mean to be able to test new stuff on one WAN 
address without interfering with live servers on another.
Which of course is why I asked. I already know it's a rare feature (why? - I 
wonder - is it so hard to implement?), which is why I asked for recommendations 
for a router that does."
    @a: "<quote>
No,merely saying that multiple IP addresses are not *necessary* for 
multiple web servers or multiple mail domain feeds.
If the OP is running a sufficiently complex set of machines to do 
otherwise, what is he doing asking in a noddy group to do with domestic 
broadband anyway?
Time to get a Cisco, spend the money and the time learning how to do 
proper routings and so on.
Having DONE all that for a living, I am disinclined to do it when it 
isn't necessary.
And if he DOERS have all those IP addresses, why not set one up on the 
far side of his router, and test from there backwards?
What he SEEMS to be saying is that he wants to take his subnet, and 
split it into two separate subdomains..possibly on separate cables as 
well. That implies an ethernet-to-ethernet router. One probably with DSL 
as well.
That is not a domestic router. Sounds to me like a small chassis Cisco 
with three interface cards minimum. Though I am about 5 years out of 
date as to what is available.
Or use a PC with 2-3 interface cards running Linux with ipforwarding and 
possibly iptables as well.."
    @whatmeworry: "<quote>
Actually, I'm asking in uk.net.providers.aaisp, which is by no means a noddy 
group to do with domestic broadband. I left in the cross-posting in the hope 
that there might be someone in uk.telecom.broadband who could help.
It's perfectly possible for a cheap, ADSL router to do this. The Zyxel 
P-660HW-61 worked fine. Unfortunately my -61 broke, and when I ordered a 
replacement I was sent a -D1 instead. The -D1 is allegedly a lot better on 
ADSL2+, which I will be getting soon, and it supports faster wireless (I could 
live without that), BUT they have messed up the NAT loopback so that it only 
works from a given WAN address back to itself, not between different WAN 
addresses. It may only require a firmware update from Zyxel, but as they 
haven't replied to my query, and based on previous lack of success with their 
support people, I don't think this is very likely."
    @a: "<quote>
yeah..I saw the cross posting later.
One of the reasons to use a Cisco, is that people who use them do this 
sort of thing regularly, and the support people, who are paid good 
money, understand this sort of question.
The average 'plastic box with the lights on' offering is mass produced 
and supported by people who are just about up to  answering questions 
like 'what is the red light on the left for'.
Its pot luck which does what. I have a d-link. Its not great, its ten 
years old BUT it supports SNMP so mrtg works. It doesnt as far as I know 
allow me to syslog its logfile t my Linux.
OTOH a friends netgear does, but doesn't do SNMP.
His Belkin, was smart enogh to route to the WAN address of a NAT 
translated machine inside the network. That broke in a thunderstorm, and 
his netgear does not.
Neither does my D-link.
So I set up a dummy DNS inside the network to spoof the LAN addresses of 
the local web servers.
Anyway, have a look at a cisco 1800 range router. That looks like it 
would do the job."
    @whatmeworry: "<quote>
I've just looked at Cisco prices. Sorry, but I don't need NAT loopback that 
badly. For a lot less than that I could install a completely separate ADSL line 
and connect between them."
    @Christopher3b: "On Thu, 22 Jan 2009 15:28:17 +0000, Alfred E Neuman
<quote>
Surely using multiple routers, the one on the ADSL line in non-NAT
mode is better then that!"
    @a: "<quote>
I see you are coming round to my way of thinking. Complexity and 
elegance ain't worth the cost ;-)"
    @whatmeworry: "<quote>
It is. In fact that is Plan B. I was simply pointing out that for the cost of a 
Cisco I could pay for even the least cost-effective alternative option and 
still have money to spare."
    @whatmeworry: "<quote>
Complexity and elegance have nothing to do with it. I just want to be able to 
connect to my own servers from my own PCs in exactly the same way as I connect 
to them from the outside world - via the IP address in the public DNS - and do 
this in the simplest and cheapest way possible.
The Zyxel P-660HW-61 did this fine, once I'd found my way around its quirks, 
but the -D1 does not. Not with the current firmware, anyway."
    @stuart: "<quote>
Alfred,
Admittedly I haven't read all the posts but from the description of your
requirements above could asking A&A to route a public address range via
your WAN address be an acceptable solution?
Stu"
    @whatmeworry: "<quote>
I'm not sure how that differs from what I have already. At the moment there is 
a single WAN address (for simple NAT operation) plus my bank of 16 addresses, 
all routed to and from my ADSL line. When I'm in multiple NAT mode I appear to 
be able to use all of these addresses interchangeably (I haven't tried the 
first or last of the 16 as I think they are reserved, though whether this 
restriction applies in NAT mode I don't know). I can send and receive packets 
to the outside world from any of these addresses, and I can even send from one 
address back to a different port on the same address (with NAT loopback enabled 
on the Zyxel). The only problem is when I try to send from one of my addresses 
to another ... the receiving end gets the connection request, but times out 
trying to send the reply. As I say, with the old P-660HW-61 this worked fine."
    @stuart: "<quote>
The only difference would be you wouldn't need NAT if the addresses were
publicly routable so you wouldn't need to worry so much about rare
router functionality.  Of course, "needing" NAT and "wanting" NAT are
two different things.  If you "want" NAT (rather than need it) then this
solution obviously doesn't apply.  Personally I neither want or need NAT.
This is the way I do it.  I have a publicly routable address range so I
don't use hutchinsonchad@example.com.  Whether I'm connecting internally or externally I
use the same DNS names or IPs and I can run as many completely separate
servers as I have IPs.  Solves the loopback NAT problem and I don't need
to fudge internal DNS.
I'm a great fan of simple & cheap :)
I only mention it as a potential option.  Just because it suits me
doesn't mean it will suit you.
Stu"
    @whatmeworry: "<quote>
Ah, I see. I prefer to use NAT as it provides immunity from incoming 
connections by default, even when I'm experimenting with a setup lacking a 
proper firewall. I tried running a Win2k system without NAT once and in the 
flood of firewall requests to approve connections I missed a dodgy one and the 
machine was infected with a trojan within about 5 minutes.
I map each main PC via its own NAT group to a single WAN address, so I get the 
benefits of NAT as well as a dedicated external IP per PC. Then there is a LAN 
IP for servers, which normally maps to a second IP on the main PC, and a DHCP 
NAT group for "guest" PCs like laptops.
Also, I want to be free to assign my own LAN addresses any way I like. I can 
have DNS for several servers of different types pointing to the same WAN IP, 
but then route them to different PCs if I like, without having to wait for 
every DNS in the world to expire its TTL (including cache programs that ignore 
the TTL and retain addresses for longer)."
    @news: "On Thu, 22 Jan 2009 13:20:54 +0000, The Natural Philosopher <email_address>
wrote:
<quote>
What is wrong with uk.net.providers.aaisp?
I know there are some high and mighty fuckwits in there that think they
are better than the rest, but on the whole they are not a bad bunch."
    @whatmeworry: "<quote>
Yes, I'm aware of that ... but thanks for the tip anyway. Always best to be sure.
I always run a remote port scan (e.g. grc.com) after changing anything 
significant, to make sure I'm not letting anything in."
    @a: "<quote>
However, a *properly* configured firewall is just as good as NAT..
You start with 'alle is verboten' and move on from there...;-)
Which suggest another way to attack this problem.
Make your own router out of a scrap PC and Linux, keep the ADSL router 
for just interfacing with the line, and do everything - NAT and 
firewalling and routing, on a stripped down PC chassis. With the 
advantage of having proper logging and infinite flexibility."
    @michaelkintzios: "<quote>
How would you configure a cisco to do that?  Using DNS proxy and mapping a
FQDN to a LAN address?
Regards,
Mick
(Change nomail.afraid.org 
to gmail to reply by email)"
    @a: "<quote>
That's how I do it WITHOUT a Cisco :-)
WITH a cisco. you can route between the same ethernet port...Its really 
a function of how the NAT is configured with respect to the routing.
If NAT is done on the inside LAN side, then the wide area addresses can 
be routed correctly, but if its done on the WAN side, the internal 
routing doesn't ever see the WAN address.."
{'source': 'USENET', 'other_information': '{"reply_count": 33, "forum_name": "uk.net.providers.aaisp.20140909.mbox"}', 'file': 'data/output/usenet-uk.net.parquet'}